Build a Firewall that tells Hackers to Try Harder

Introduction

In this tutorial, we will build a custom firewall using Python that not only secures your VPS from potential hackers but also sends them a humorous message: "Try Harder!" This guide walks you through understanding TCP, setting up a firewall with IP tables, and using Scapy for packet monitoring, all while adding a lighthearted touch to cybersecurity.

Step 1: Understand TCP and the Three-Way Handshake

Before diving into firewall setup, it’s essential to grasp how TCP works, particularly the infamous three-way handshake, which establishes a connection between a client and server.

• Three-Way Handshake Process:
  1. SYN: The client sends a SYN (synchronize) packet to the server to initiate a connection.
  2. SYN-ACK: The server responds with a SYN-ACK (synchronize-acknowledge) packet.
  3. ACK: The client sends back an ACK (acknowledge) packet, establishing the connection.

Understanding this process helps identify how attackers may try to exploit vulnerabilities during this phase.

Step 2: Set Up Your Firewall with IP Tables

Setting up a firewall using IP tables is crucial for controlling incoming and outgoing traffic on your server.

• Installing IP Tables:

  • Most Linux distributions come with IP tables pre-installed. You can check its status with:

    sudo iptables -L
    

• Basic Commands:

  • To block a specific IP address:

    sudo iptables -A INPUT -s <attacker_ip> -j DROP
    

• Save Your Configuration:

  • After setting up your rules, ensure to save them:

    sudo iptables-save > /etc/iptables/rules.v4
    

Step 3: Monitor Incoming Packets with Scapy

Scapy is a powerful Python library for packet manipulation and monitoring. Here’s how to use it to detect suspicious activity.

• Install Scapy:

  • If you don’t have Scapy installed, you can do so via pip:

    pip install scapy
    

• Basic Packet Sniffer:

  • Use the following script to start monitoring packets:

    from scapy.all import *
    
    def packet_callback(packet):
        if packet[TCP].dport == 80:
            print(f"Packet: {packet.summary()}")
    
    sniff(filter="tcp", prn=packet_callback, store=0)
    

• Detecting Scans:

  • Monitor for multiple connection attempts from the same IP within a short timeframe. You can enhance the packet_callback function to count these attempts and block the IP if they exceed a predefined threshold.

Step 4: Respond to Attackers

Adding humor to your firewall can make the experience enjoyable while maintaining security.

• Send a Cheeky Message:
  • Modify the blocking function to include sending a message before dropping the connection. This can be implemented using Scapy:

    def block_ip(attacker_ip):
        print(f"Sending message to {attacker_ip}: Try Harder!")
        # Code to send a packet with the message (custom implementation needed)
        os.system(f"iptables -A INPUT -s {attacker_ip} -j DROP")
    

Conclusion

By following these steps, you can create an effective and entertaining firewall for your VPS. You have learned how TCP works, set up IP tables to control traffic, used Scapy for monitoring packets, and even added a humorous touch to your security measures.

For next steps, consider experimenting with more advanced features in Scapy, customizing the messages sent to attackers, or exploring other cybersecurity techniques to further enhance your server's security. Happy coding, and remember to practice ethical hacking!